改进的进程行为检测模型及实现  

Improved model of process behavior detection and implementation

作　　者：唐彰国[1] 李焕洲[1] 钟明全[1] 张健[1] 

机构地区：[1]四川师范大学网络与通信技术研究所,成都610066

出　　处：《计算机应用》2010年第1期207-209,223,共4页journal of Computer Applications

基　　金：四川省应用基础研究项目(07JY029-011)

摘　　要：为了检测恶意程序,分析了现有各类检测机制的不足,重新界定了进程行为概念的外延,提出了差量对比与进程动态行为分析的检测模型,给出了关键技术和实现方法。测试结果表明该检测模型在通用性和有效性方面优于传统检测方法。To detect malicious program, the disadvantages of current detection mechanism were analyzed. The extension of process behavior concept was redefined. A detection model of difference comparison and process dynamic behavior analysis was proposed. The critical technology and realization were given. The experimental results indicate that the detection model excels traditional detection method in versatility and effectiveness.

关 键 词：恶意程序 差量对比 检测模型 API函数 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]